Should someone send them a sternly worded email for them to ignore?

Or maybe they should be allowed to do whatever they want regardless of what risk it poses to the organization?